Posted by wondersky 9 hours ago
This is an SGLANG and a Cloudflare bug long before it is a Z.AI model bug, I don't see what they could have done about it. Cloudflare should own it instead of naming other (imo innocent) parties in the title.
There's a huge amount of unnecessary extraneous details in the headline that distract from "this is a Cloudflare bug".
Which part of that is not claiming the exposure is in X model? Cloudflare is stopping to be cool, this is the start. I guess, cf is now big enough for enshitification to start.
"On September 8, 2026, we were alerted by a security researcher, Gadi Evron from Knostic, to a tenant isolation issue affecting the GLM-5.3 Workers AI model (@cf/zai-org/glm-5.3) starting on August 27, 2026."
Meaning the issue was a cache exposure with the GLM-5.3 Workers AI model. If the title was, "Cache exposure issue with GLM-5.3," I would agree it's ambiguous and maybe intentionally harmful. But it literally says, "Workers AI model" which is clearly a Cloudflare product.
Downthread I suggested "Cloudflare configuration error leaked data between user sessions" which I think is far better. You could improve on it further: "Cloudflare AI worker configuration error leaked data between user sessions". But this could have happened with any model.
Also impressed with the speed to address the issue unplug the model and then pretty quick remediation, the speed to remediation matters less to me, but good to see they can act quickly on their platform to kill the serving of the model.
Did they advertise it as 1,048,576 token when they only had room for 681,280 tokens?
They assumed that it wasn't like an overflow exploit, despite the fact that's exactly what they'd set up to happen, on the grounds of thinking the equivalent of, "oh this probably uses smart pointers, we'll be fine".
That's how I read it anyway.
At a minimum someone should have realized during testing that their utilization figures are off by 40%.
A much better title would be "Cloudflare configuration error leaked data between user sessions"
I copied the clipboard from the device, and my clipboard was full of another users credentials that they were obviously trying to paste into their own VM. Their devices were leaking clipboard data to each other.
I reported the vulnerability and asked if there was any bounty program (I wasn't looking for vulnerabilities but didn't hurt to ask), to which they said no, but they could send me a signed letter thanking me of my contributions. I said, great, thanks - and never heard back.
All pretty disappointing.